SchildmarkISO/IEC 27001:2022
ISO 27001 Annex A: technological controls you can show working
Your auditor does not want to hear that monitoring exists; they want records showing it ran for the whole period. Schildmark runs vulnerability management, configuration checks, logging and monitoring across your machines and clouds, and exports those records as one file.
What Annex A asks for on the technical side
ISO/IEC 27001:2022 Annex A has 93 controls in four themes. You declare in your Statement of Applicability which apply; for these, an auditor wants to see that they operate.
- 8.7 Protection against malware
- Protection against malware, supported by user awareness.
- 8.8 Management of technical vulnerabilities
- Obtain information about technical vulnerabilities, evaluate your exposure, and take appropriate measures.
- 8.9 Configuration management
- Establish, document, implement, monitor and review configurations, including security configurations.
- 8.15 Logging
- Produce, store, protect and analyse logs that record activities, exceptions, faults and other relevant events.
- 8.16 Monitoring activities
- Monitor networks, systems and applications for anomalous behaviour, and act to evaluate potential incidents. New in the 2022 edition.
- 5.24 to 5.28 Incident management
- Plan and prepare (5.24), assess events (5.25), respond (5.26), learn from incidents (5.27) and collect evidence (5.28).
The 2013 edition is gone: the transition period for certificates ended on 31 October 2025, so audits run against the 2022 numbering used here.
Control, what Schildmark does, and the evidence
What Schildmark runs for each control, and what you can hand your auditor for the period.
| Requirement | What Schildmark does | Evidence it produces |
|---|---|---|
| 8.7 | Not an anti-malware product. Alerts from Microsoft Defender for Endpoint and Sophos Central arrive in the same list as the network sensor and everything else, so they are reviewed and acted on. | Alerts with machine, rule and time. |
| 8.8 | Vulnerabilities corroborated against vendor and NVD data, known-exploited first; patches rehearsed, approved, installed in the exact version and verified as fixed; accepted risks with owner and expiry. | vulnerabilities_fixed.csv, patch_activity.csv |
| 8.9 | CIS benchmark checks on every machine, read again every 10 minutes, each naming the controls it supports. | controls.csv for ISO 27001, configuration_checks.csv, configuration_scores.csv. |
| 8.15 | Logs from machines, firewalls, Microsoft 365, AWS and Google Cloud, read by the detection rules. Alerts and network events are kept for 7 to 3,650 days (45 by default), with a warning below 365. | README.txt with retention and any shortfall; audit_trail.csv. |
| 8.16 | Detection rules over every source, one severity scale, a threat map, and an analyst you can ask about any alert or machine. | Alerts for the period, with rule and MITRE technique. |
| 5.25, 5.26, 5.28 | Assess an alert with everything about it in one panel; block the source on your firewall with a required reason; rule actions can wait for approval. | The decoded log line; blocks and mutes with reasons in the audit trail. |
One honest limit: on the compliance page, ISO 27001 evidence comes from configuration checks only, because the detection rules tag their alerts with SOC 2, PCI DSS, HIPAA, NIST 800-53 and GDPR controls, not ISO 27001 ones. The alerts, audit trail and verified fixes are in the evidence pack all the same; you map them to Annex A in your Statement of Applicability. More on detection, verified patching, the compliance page and evidence pack, and in the documentation: Compliance, Patching.
What Schildmark does not cover
ISO 27001 certifies a management system, not a tool. Your ISMS team or a consultant covers these.
- Clauses 4 to 10
- Scope, risk assessment and treatment, the Statement of Applicability, internal audit and management review.
- Organisational controls
- Policies, roles, supplier relationships, legal requirements, incident planning (5.24) and lessons learned (5.27).
- People and physical controls
- Screening, awareness training, physical perimeters and equipment.
- Other technological controls
- Identity and access for your systems, cryptography, backup, secure development and data leakage prevention.
- The certification
- The audit by an accredited certification body.
How a rollout looks
Usually days, not months. Nothing needs to be installed on your firewalls.
Choose where it runs
Hosted by us, or on one or two of your own Linux servers. Either way, you get a stack of your own.
Enrol the machines
One command per machine on Windows, macOS and Linux, or an MSI for Intune, Configuration Manager or Group Policy.
--patchingadds patching.Connect the rest
Firewall logs, Microsoft 365, AWS and Google Cloud, and the firewalls you block on, set up in the console.
Choose ISO 27001, export
Turn on ISO 27001 on the compliance page, set retention, and export the evidence pack for the audit period.
Questions people ask
What changed in Annex A with ISO 27001:2022?
Annex A went from 114 controls in 14 domains to 93 controls in four themes: organisational, people, physical and technological. Eleven controls are new, among them 8.9 configuration management, 8.16 monitoring activities, 5.7 threat intelligence and 8.12 data leakage prevention.
Is an ISO 27001:2013 certificate still valid?
No. The transition period ended on 31 October 2025. Certificates that were not moved to the 2022 edition by then expired or were withdrawn, and the organisation needs a new certification audit against ISO/IEC 27001:2022.
What does ISO 27001 Annex A 8.16 require?
That networks, systems and applications are monitored for anomalous behaviour, and that appropriate action is taken to evaluate potential information security incidents. An auditor will want to see what you monitor, how alerts are evaluated, and records showing it happened during the period.
How long does ISO 27001 say logs must be kept?
It sets no fixed period. Control 8.15 asks for logs to be produced, stored, protected and analysed; the retention period is yours to set from your risk assessment and your legal and contractual obligations. Schildmark uses 365 days as a guideline and warns when logs are kept for less.
Will Schildmark get us ISO 27001 certified?
No. Certification is an audit of your whole information security management system by an accredited certification body. Schildmark operates and records a set of technological controls and exports the evidence for the audit period.
Audit coming up?
Tell us when your audit period starts, how many machines are in scope and which clouds you use. We will show you the evidence Schildmark produces for it. Priced per protected machine.